CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!

Threat and Vulnerability Intelligence Database

RSS Feed

Example Searches:

CVE-2024-29741

Description: In pblS2mpuResume of s2mpu.c, there is a possible mitigation bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

CVSS: HIGH (7.8)

EPSS Score: 0.02%

SSVC Exploitation: none

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2025-1691

Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9.  The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker. References https://nvd.nist.gov/vuln/detail/CVE-2025-1691 https://jira.mongodb.org/browse/MONGOSH-2024 https://github.com/advisories/GHSA-43g5-2wr2-q7vj

CVSS: HIGH (7.6)

EPSS Score: 0.05%

Source: Github Advisory Database (NPM)
February 27th, 2025 (4 months ago)

CVE-2025-23687

Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in simonhunter Woo Store Mode allows Reflected XSS. This issue affects Woo Store Mode: from n/a through 1.0.1.

CVSS: HIGH (7.1)

EPSS Score: 0.04%

SSVC Exploitation: none

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2025-1756

Description: mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\. This issue affects mongosh prior to 2.3.0

CVSS: HIGH (7.5)

EPSS Score: 0.01%

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2025-1755

Description: MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\node_modules\. This issue affects MongoDB Compass prior to 1.42.1

CVSS: HIGH (7.5)

EPSS Score: 0.01%

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2025-22280

Description: Missing Authorization vulnerability in revmakx DefendWP Firewall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DefendWP Firewall: from n/a through 1.1.0.

CVSS: HIGH (7.6)

EPSS Score: 0.03%

SSVC Exploitation: none

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2025-27154

Description: Spotipy is a lightweight Python library for the Spotify Web API. The `CacheHandler` class creates a cache file to store the auth token. Prior to version 2.25.1, the file created has `rw-r--r--` (644) permissions by default, when it could be locked down to `rw-------` (600) permissions. This leads to overly broad exposure of the spotify auth token. If this token can be read by an attacker (another user on the machine, or a process running as another user), it can be used to perform administrative actions on the Spotify account, depending on the scope granted to the token. Version 2.25.1 tightens the cache file permissions.

CVSS: HIGH (8.4)

EPSS Score: 0.01%

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2024-9334

Description: Use of Hard-coded Credentials, Storage of Sensitive Data in a Mechanism without Access Control vulnerability in E-Kent Pallium Vehicle Tracking allows Authentication Bypass.This issue affects Pallium Vehicle Tracking: before 17.10.2024.

CVSS: HIGH (8.2)

EPSS Score: 0.06%

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2025-1739

Description: An Authentication Bypass vulnerability has been found in Trivision Camera NC227WF v5.8.0 from TrivisionSecurity. This vulnerability allows an attacker to retrieve administrator's credentials in cleartext by sending a request against the server using curl with random credentials to "/en/player/activex_pal.asp" and successfully authenticating the application.

CVSS: HIGH (7.1)

EPSS Score: 0.02%

Source: CVE
February 27th, 2025 (4 months ago)

CVE-2025-1691

Description: The MongoDB Shell may be susceptible to control character injection where an attacker with control of the mongosh autocomplete feature, can use the autocompletion feature to input and run obfuscated malicious text. This requires user interaction in the form of the user using ‘tab’ to autocomplete text that is a prefix of the attacker’s prepared autocompletion. This issue affects mongosh versions prior to 2.3.9.  The vulnerability is exploitable only when mongosh is connected to a cluster that is partially or fully controlled by an attacker.

CVSS: HIGH (7.6)

EPSS Score: 0.05%

Source: CVE
February 27th, 2025 (4 months ago)